迴圈語句逆向分析
阿新 • • 發佈：2021-08-29
迴圈語句逆向分析
從反彙編的角度簡單分析
while,do-while和for迴圈語句
while
CPP程式碼：
#include "stdafx.h"
void Fun() {
int s = 0, i = 1;
while (i <= 10) {
s += i++;
}
}
int main(int argc, char* argv[]) {
Fun();
return 0;
}
反彙編：
Fun: 00401020 push ebp 00401021 mov ebp,esp 00401023 sub esp,48h 00401026 push ebx 00401027 push esi 00401028 push edi 00401029 lea edi,[ebp-48h] 0040102C mov ecx,12h 00401031 mov eax,0CCCCCCCCh 00401036 rep stos dword ptr [edi] ;----------------------------------------------- 00401038 mov dword ptr [ebp-4],0 ;s=0 0040103F mov dword ptr [ebp-8],1 ;i=1 00401046 cmp dword ptr [ebp-8],0Ah 0040104A jg Fun+40h (00401060) ;i>0xA 跳轉到00401060，結束迴圈 0040104C mov eax,dword ptr [ebp-4] 0040104F add eax,dword ptr [ebp-8] 00401052 mov dword ptr [ebp-4],eax ;s=s+i 00401055 mov ecx,dword ptr [ebp-8] 00401058 add ecx,1 0040105B mov dword ptr [ebp-8],ecx ;i=i+1 0040105E jmp Fun+26h (00401046) ;跳轉到00401046繼續循壞 ;----------------------------------------------- 00401060 pop edi 00401061 pop esi 00401062 pop ebx 00401063 mov esp,ebp 00401065 pop ebp 00401066 ret
do-while
CPP程式碼：
#include "stdafx.h"
void Fun() {
int s = 0, i = 1;
do {
s += i;
} while (i++ < 10);
}
int main(int argc, char* argv[]) {
Fun();
return 0;
}
反彙編：
Fun: 0040D4B0 push ebp 0040D4B1 mov ebp,esp 0040D4B3 sub esp,48h 0040D4B6 push ebx 0040D4B7 push esi 0040D4B8 push edi 0040D4B9 lea edi,[ebp-48h] 0040D4BC mov ecx,12h 0040D4C1 mov eax,0CCCCCCCCh 0040D4C6 rep stos dword ptr [edi] ;----------------------------------------------- 0040D4C8 mov dword ptr [ebp-4],0 ;s=0 0040D4CF mov dword ptr [ebp-8],1 ;i=1 0040D4D6 mov eax,dword ptr [ebp-4] 0040D4D9 add eax,dword ptr [ebp-8] 0040D4DC mov dword ptr [ebp-4],eax ;s=s+i 0040D4DF mov ecx,dword ptr [ebp-8] ;將i先儲存一份 0040D4E2 mov edx,dword ptr [ebp-8] 0040D4E5 add edx,1 0040D4E8 mov dword ptr [ebp-8],edx ;i=i+1 0040D4EB cmp ecx,0Ah 0040D4EE jl Fun+26h (0040d4d6) ;i<0xA 跳轉到0040d4d6繼續迴圈，否則結束迴圈 ;----------------------------------------------- 0040D4F0 pop edi 0040D4F1 pop esi 0040D4F2 pop ebx 0040D4F3 mov esp,ebp 0040D4F5 pop ebp 0040D4F6 ret
for
CPP程式碼：
#include "stdafx.h"
void Fun() {
int i, s = 0;
for (i = 1; i <= 10; i++) {
s += i;
}
}
int main(int argc, char* argv[]) {
Fun();
return 0;
}
反彙編：
Fun: 00401020 push ebp 00401021 mov ebp,esp 00401023 sub esp,48h 00401026 push ebx 00401027 push esi 00401028 push edi 00401029 lea edi,[ebp-48h] 0040102C mov ecx,12h 00401031 mov eax,0CCCCCCCCh 00401036 rep stos dword ptr [edi] ;----------------------------------------------- 00401038 mov dword ptr [ebp-8],0 ;s=0 0040103F mov dword ptr [ebp-4],1 ;i=1 00401046 jmp Fun+31h (00401051) ;跳轉到00401051，決定要不要開始迴圈 00401048 mov eax,dword ptr [ebp-4] 0040104B add eax,1 0040104E mov dword ptr [ebp-4],eax ;i=i+1（收尾工作） 00401051 cmp dword ptr [ebp-4],0Ah 00401055 jg Fun+42h (00401062) ;i>0xA 跳轉到00401062，結束迴圈 00401057 mov ecx,dword ptr [ebp-8] 0040105A add ecx,dword ptr [ebp-4] 0040105D mov dword ptr [ebp-8],ecx ;s=s+i 00401060 jmp Fun+28h (00401048) ;跳轉到00401048做收尾工作 ;----------------------------------------------- 00401062 pop edi 00401063 pop esi 00401064 pop ebx 00401065 mov esp,ebp 00401067 pop ebp 00401068 ret